Perspectives is a research project to improve SSH-style Host Authentication with Multi-path Network Probing by researchers of the computer science department at Carnegie Mellon University. The title of their research surely sounds scary for many Internet users but it basically means that they have created a method to authentic hosts securely by pulling their information from various servers and comparing those results with the users.
This practically eliminates the danger of man-in-the-middle attacks because the attacker does not have a way to manipulate the traffic of the independent servers who get the important information as well.
Best of all, they have created a Firefox extension that protects the user’s system after installation. The Firefox extension provides two benefits over not using it. The first is something that users might have experienced already. If a user connects to a website with an untrusted certificate he has to manually allow the connection to the website by using exceptions.
Perspective can detect the validity of the certificate and automatically override the manual exception if it is a valid certificate. Perspective warns the user if an attacker has managed to trick a Certificate Authority into incorrectly issuing a certificate.
A valid site displays a green icon next to the Perspective name in the Firefox statusbar. I did not come up with any fake sites yet but I suppose they show up as a red cross.
The default setting of Perspectives is that it only reacts when a certificate comes up with a Firefox security error. This can be changed in the options to provide information for all https connections.
Related posts:
Add And Edit Cookies Firefox ExtensionFirefox Locationbar Extension
Screengrab Add-on for Firefox 2.x
Firefox Extensions Website Gets Overhaul. Collections Introduced
Open Multiple Bookmarks in Firefox at once
Realtime Anti-Phishing Add-on for Firefox gone bad
Use the Foxtor Extension for anonymous surfing
Firefox 3 Beta 3 has been released
this looks like a good add on. thanks for the heads up.
Just tested it out today. It’s an awesome extension. The only thing I don’t like is that I have to allow my Firefox to go out of my firewall as a server when using it. Guess there’s no helping it if they want to query the certification sites. But it would be nice if I can still lock my browser out from serving as a server.